Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: NLnet Labs Unbound 1.26.2 Clear all filters
TI-2026-78586 CVE-2026-97206 · GHSA-jc7q-6h55-rr57

Unbound DoQ path migration use-after-free on multi-threaded deployments

Priority LOW 39

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00334 Published 2026-10-21 Fixed in 1.26.2 CWE-416
TI-2026-78584 CVE-2026-96405 · GHSA-r7j4-9v27-x32x

Unbound resolver lacks aggregate limit on DNS compression pointers

Priority LOW 30

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2026-10-21 Fixed in 1.26.2 CWE-770
TI-2026-78546 CVE-2026-50106 · GHSA-pj55-6fvm-845h

Unbound NXDOMAIN denial for island trust anchor under insecure parent

Priority LOW 28

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root cha…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00207 Published 2026-10-21 Fixed in 1.26.2 CWE-807
TI-2026-78543 CVE-2026-35501 · GHSA-mh74-9w87-h7vx

Trust island bypass in NLnet Labs Unbound via forged NSEC replies

Priority LOW 16

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the ro…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00111 Published 2026-10-21 Fixed in 1.26.2 CWE-354
TI-2026-78614 CVE-2026-109125 · GHSA-66rc-377g-m4m4

Cache side-channel in NLnet Labs Unbound leaks upstream source port

Priority LOW 23

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration).

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00172 Published 2026-10-21 Fixed in 1.26.2 CWE-205